Azure riskdetection: Attempted Primary Refresh Token (PRT) Access

Identifies Azure risk events indicating an attempted PRT access that can enable lateral movement or credential theft.

FreeUnreviewedSigmahighv1

azure-riskdetection-attempted-primary-refresh-token-prt-access-a84fc3b1

title: "Azure riskdetection: Attempted Primary Refresh Token (PRT) Access"
id: 6d490b24-cf60-4404-87fc-f8143d3fd3e5
status: test
description: This rule flags risk events where an access attempt is made to the Primary Refresh Token (PRT) resource. Attackers may use PRT access to facilitate lateral movement within an organization or to support credential theft. The detection relies on Azure risk detection telemetry reporting riskEventType values of attemptedPrtAccess.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#possible-attempt-to-access-primary-refresh-token-prt
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_prt_access.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-07
tags:
  - attack.t1528
  - attack.credential-access
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: attemptedPrtAccess
  condition: selection
falsepositives:
  - This detection is low-volume and is seen infrequently in most organizations. When this detection appears it's high risk, and users should be remediated.
level: high
license: DRL-1.1
related:
  - id: a84fc3b1-c9ce-4125-8e74-bdcdb24021f1
    type: derived

What it detects

This rule flags risk events where an access attempt is made to the Primary Refresh Token (PRT) resource. Attackers may use PRT access to facilitate lateral movement within an organization or to support credential theft. The detection relies on Azure risk detection telemetry reporting riskEventType values of attemptedPrtAccess.

Known false positives

This detection is low-volume and is seen infrequently in most organizations. When this detection appears it's high risk, and users should be remediated.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.